splunk 6 forwarder headers?

[a212830]

Hi,

I seem to recall hearing about some new features in Splunk 6, where we can define "headers" that should be ignored by the forwarder. Am I imagining things? I can't find any doc that might show those features.

[alacercogitatus]

As long as your junk matches a PREAMBLE_REGEX setting, it should be filtered out.

For example, IIS might have this:

PREAMBLE_REGEX = ^#

[a212830]

Thanks. I was hoping it worked similar to some awk functions, where you could identify the start of a section and the end of a section.

[alacercogitatus]

Any line that starts with "#" will be removed. I don't think it knows about "start" and "end" of a preamble.

[a212830]

Thanks. Do I need to enter regex for each line (which stinks), or is there a way to signify the start of the preamble and the end of the preamble?

[a212830]

looking for examples on using the preamble_regex. Can I specify a start section/end section?

For example:

Line 1 preamble...
junk
more junk
even more junk
end of preamble

Is there a way to filter all that out?

[alacercogitatus]

Can you define "headers"? What OS? What log sources?